Ransomware Attack on Your SME: 7 Immediate Steps to Take
Cybersecurity · By Equipa ONEGEST ·
If ransomware strikes your business, immediate containment is crucial. Learn the 7 exact steps to isolate infected machines, preserve backups, and recover safely without paying a ransom.
If your business is attacked by ransomware, immediately isolate infected computers by disconnecting Ethernet cables and disabling Wi-Fi, without turning off or restarting the machines. Next, photograph the ransom demand on screen, refuse to pay the attackers, verify that your isolated backups remain uncompromised, and contact your IT support provider to handle containment and recovery. Taking these steps in the first minutes prevents the malware from spreading across your entire company network.
What Is Ransomware and Why Are SMEs Targeted?
Ransomware is a malicious software program designed to encrypt critical company files, blocking access to operational data, databases, accounting tools, and shared drives. Once encrypted, the attackers leave a ransom note demanding payment—usually in cryptocurrency—in exchange for a decryption key that may not even work. For small and medium-sized enterprises (SMEs), a single incident can result in days of operational downtime, permanent data loss, and substantial financial damage.
Cybercriminals target SMEs because small businesses often operate with less robust perimeter defenses, delayed software patches, and limited real-time monitoring. Without dedicated security controls, a single compromised email attachment can encrypt shared drives within minutes. Knowing exactly how to respond during the first few moments determines whether an incident remains a contained disruption or becomes a catastrophic failure for your organization.
What Immediate Actions Should You Take After a Ransomware Incident?
When a ransom notification appears on an employee screen or files suddenly become unreadable, quick and structured action is required. Follow these seven steps chronologically to limit damage and preserve recovery options.
1. Disconnect Ethernet Cables and Turn Off Wi-Fi
Ransomware moves rapidly through local networks to infect connected servers, cloud sync folders, and peer workstations. Immediately unplug the network cable from the affected computer, turn off its Wi-Fi connection, or enable flight mode. If the device connects to your main infrastructure via a VPN, terminate that connection immediately.
2. Do Not Power Off or Restart the Computer
Turning off the machine using the power button or restarting it is a common mistake. Powering down can trigger aggressive encryption routines left pending in memory, corrupt operating system files, or wipe volatile RAM evidence needed by IT specialists to analyze the attack vector. Keep the system powered on, but completely disconnected from all networks.
3. Alert Your Team and Block Shared Drives
Inform all staff members immediately so they stop sending files, close active business applications, and report any unusual activity on their screens. Your internal administrator or managed IT partner must promptly lock compromised user accounts and disable access to shared network folders on local servers or cloud storage.
4. Capture Evidence of the Ransom Note
Do not close the extortion window or attempt to delete infected files. Take a clear photograph of the ransom note showing the contact instructions, payment addresses, and unique incident ID using a mobile phone. Security professionals analyzing your SME cybersecurity situation use these details to identify the exact ransomware variant and check if public decryption keys exist.
5. Refuse to Pay the Ransom Demand
Paying extortion fees to cybercriminals provides no legal guarantee that you will receive a functional decryption key. Furthermore, submitting to payment marks your SME as an easy target for future extortion schemes. Management attention should be focused entirely on restoring systems from verified, clean backups.
6. Check the Isolation and Integrity of Your Backups
Modern ransomware actively searches for attached network backups to encrypt or delete them before locking local endpoints. Before initiating any restore process, confirm that your backup and business continuity systems are fully separated from the infected network segment. Immutable cloud backups or offline copies are your safest path to full operational recovery.
7. Notify Authorities and Comply with Data Regulations
Under regulations like the GDPR, if personal data belonging to clients, employees, or suppliers may have been breached or accessed by unauthorized third parties, your business must notify the relevant data protection authority within 72 hours. Companies falling under European frameworks like the NIS2 directive must also adhere to strict incident reporting timelines with regulatory bodies.
Immediate Response Matrix: What to Do vs. What Never to Do
| What to Do Immediately | What You Should Never Do |
|---|---|
| Unplug network cables and turn off Wi-Fi | Power off or restart the infected computer |
| Photograph the ransom note on screen | Pay the ransom fee to the extortionists |
| Alert your workforce and isolate network drives | Ignore the alert and continue working on the network |
| Verify offline and cloud backup integrity | Plug external USB drives into an infected system |
| Contact specialized technical support | Attempt to manually delete encrypted system files |
How Can You Recover Systems and Prevent Future Ransomware Attacks?
Once initial containment is achieved, business recovery requires deep infrastructure remediation before restoring operational data. Bringing systems back online without thorough cleaning risks re-triggering dormant malware remnants left behind by the attackers.
To build long-term resilience against cyber threats, SMEs should deploy a layered defense strategy:
- Endpoint Detection and Response (EDR): Replace basic antivirus software with advanced EDR solutions that monitor file behaviors in real time and automatically halt malicious encryption processes.
- Perimeter Defense and Secure VPNs: Protect office networks using enterprise firewalls with active traffic inspection and enforce encrypted VPN connections for remote workers.
- Email and Productivity Protection: Since email phishing is the primary entry point for ransomware, implement advanced spam filtering and authentication across your cloud email and productivity suite.
- Immutable Offsite Backups: Secure continuous, automated backups stored in isolated environments so your business can recover completely without relying on cybercriminals.
- Managed Support and Monitoring: Partner with a dedicated IT support and outsourcing service to keep your infrastructure updated, monitored, and supported by rapid incident response SLAs.
Frequently asked questions
Should our business pay the ransom demanded by attackers?
No. Paying cybercriminals offers no guarantee that your files will be restored, and it finances illegal operations. It also labels your business as a paying target, significantly increasing the likelihood of secondary attacks in the future.
How does ransomware typically breach an SME network?
The most common attack vector is malicious email phishing, where an employee unwittingly opens an infected attachment or clicks a fraudulent link. Unprotected Remote Desktop Protocol (RDP) connections, weak user passwords, and unpatched software vulnerabilities are also frequent entry points.
How long does it take to restore business operations after an attack?
Recovery duration depends on the volume of affected data and the availability of uncompromised backups. With structured, isolated cloud backups, critical business systems can often be restored within hours or a couple of days. Without clean backups, recovery can take weeks or result in permanent data loss.
Is standard antivirus software enough to block modern ransomware?
Traditional signature-based antivirus solutions are no longer adequate against evasive, modern ransomware variants. Effective defense requires Endpoint Detection and Response (EDR) technology that analyzes file behavior and isolates suspicious activities dynamically.
Protect Your SME Against Ransomware Threats
Responding effectively to a ransomware incident requires rapid execution, technical precision, and verified backup safeguards. To audit your defensive posture or recover safely from network vulnerabilities, explore our full suite of SME cybersecurity services. Book a free, no-obligation 20-minute IT assessment on the ONEGEST contact page to keep your business secure and operational.